> so exactly when does tcpdump intercept the packets that are > sent..and how..? > john check out dev_queue_xmit_nit() in core/dev.c. its a registered network tap which gets a cloned skb when dev_queue_xmit_nit cycles through the ptype_all list. thanks, Nivedita - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
